diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml
new file mode 100755
index 0000000..6cf4933
--- /dev/null
+++ b/.github/workflows/aur-publish.yml
@@ -0,0 +1,74 @@
+name: Publish to AUR
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  aur-publish:
+    name: Publish deskify-bin
+    runs-on: ubuntu-latest
+    container: archlinux:latest
+
+    steps:
+      - name: Install dependencies
+        run: |
+          pacman -Syu --noconfirm
+          pacman -S --noconfirm --needed base-devel git openssh curl
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Generate PKGBUILD (deskify-bin)
+        run: bash packaging/generate-pkgbuild-bin.sh "${GITHUB_REF_NAME}"
+
+      - name: Generate .SRCINFO
+        run: |
+          cd packaging
+          makepkg --printsrcinfo > .SRCINFO
+
+      - name: Configure SSH for AUR
+        env:
+          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+        run: |
+          test -n "${AUR_SSH_PRIVATE_KEY}" || { echo "Missing secret: AUR_SSH_PRIVATE_KEY" >&2; exit 1; }
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          printf "%s\n" "${AUR_SSH_PRIVATE_KEY}" > ~/.ssh/aur
+          chmod 600 ~/.ssh/aur
+          ssh-keyscan -t rsa,ecdsa,ed25519 aur.archlinux.org >> ~/.ssh/known_hosts
+          cat >> ~/.ssh/config <<'EOF'
+          Host aur.archlinux.org
+            User aur
+            IdentityFile ~/.ssh/aur
+            IdentitiesOnly yes
+          EOF
+
+      - name: Publish to AUR (deskify-bin)
+        env:
+          AUR_USERNAME: ${{ secrets.AUR_USERNAME }}
+          AUR_EMAIL: ${{ secrets.AUR_EMAIL }}
+        run: |
+          git config --global user.name "${AUR_USERNAME:-deskify-bot}"
+          git config --global user.email "${AUR_EMAIL:-noreply@example.invalid}"
+
+          rm -rf /tmp/aur-repo
+          git clone ssh://aur@aur.archlinux.org/deskify-bin.git /tmp/aur-repo
+
+          cp packaging/PKGBUILD /tmp/aur-repo/PKGBUILD
+          cp packaging/.SRCINFO /tmp/aur-repo/.SRCINFO
+
+          cd /tmp/aur-repo
+          if git diff --quiet; then
+            echo "No changes to publish."
+            exit 0
+          fi
+
+          git add PKGBUILD .SRCINFO
+          git commit -m "Update deskify-bin to ${GITHUB_REF_NAME}"
+          git push
+
diff --git a/packaging/README.md b/packaging/README.md
index e665375..5f35e67 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -1,4 +1,4 @@
-## AUR package template (manual)
+## AUR package template (manual + CI)
 
 This folder contains a minimal `PKGBUILD` template for a future AUR package:
 
@@ -9,7 +9,7 @@ Notes:
 - Update `_tag` and `pkgver` when you publish a new release tag.
 - Update `sha256sums` to match the release asset + LICENSE for that tag.
 
-Local build test:
+### Local build test
 
 ```bash
 cd packaging
@@ -24,3 +24,46 @@ curl -fL -o /tmp/deskify-linux-x86_64 "https://github.com/spalencsar/deskify/rel
 curl -fL -o /tmp/LICENSE "https://raw.githubusercontent.com/spalencsar/deskify/${TAG}/LICENSE"
 sha256sum /tmp/deskify-linux-x86_64 /tmp/LICENSE
 ```
+
+### Manual AUR publish (first time)
+
+1. Create an AUR account and submit the `deskify-bin` package once via the AUR web UI.
+2. Configure SSH for AUR and test connectivity.
+3. Clone the AUR repo, copy `PKGBUILD` and `.SRCINFO`, then push.
+
+Example:
+
+```bash
+ssh-keygen -t ed25519 -f ~/.ssh/aur -C "deskify-aur"
+# Add ~/.ssh/aur.pub to: aur.archlinux.org -> My Account -> SSH Keys
+
+cat >> ~/.ssh/config <<'EOF'
+Host aur.archlinux.org
+  IdentityFile ~/.ssh/aur
+  User aur
+EOF
+
+ssh -T aur@aur.archlinux.org
+
+git clone ssh://aur@aur.archlinux.org/deskify-bin.git
+cd deskify-bin
+
+cp /path/to/deskify/packaging/PKGBUILD .
+makepkg --printsrcinfo > .SRCINFO
+
+git add PKGBUILD .SRCINFO
+git commit -m "Initial release: deskify-bin"
+git push
+```
+
+### CI publish on tags
+
+This repo includes a workflow that publishes `deskify-bin` on tag pushes (`v*`):
+
+- `.github/workflows/aur-publish.yml`
+
+Required GitHub secrets:
+
+- `AUR_SSH_PRIVATE_KEY` (private key content for the AUR account)
+- `AUR_USERNAME` (optional, used for git commits)
+- `AUR_EMAIL` (optional, used for git commits)
diff --git a/packaging/generate-pkgbuild-bin.sh b/packaging/generate-pkgbuild-bin.sh
new file mode 100755
index 0000000..b073752
--- /dev/null
+++ b/packaging/generate-pkgbuild-bin.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TAG="${1:-}"
+if [[ -z "${TAG}" ]]; then
+  TAG="$(git describe --tags --abbrev=0)"
+fi
+
+if [[ "${TAG}" != v* ]]; then
+  echo "Error: expected tag like v0.1.0-alpha.7, got: ${TAG}" >&2
+  exit 1
+fi
+
+VERSION="${TAG#v}"
+
+# Arch PKGBUILD pkgver must not contain '-'. Use dots instead.
+PKGVER="${VERSION//-/.}"
+
+ASSET_URL="https://github.com/spalencsar/deskify/releases/download/${TAG}/deskify-linux-x86_64"
+LICENSE_URL="https://raw.githubusercontent.com/spalencsar/deskify/${TAG}/LICENSE"
+
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "${tmp_dir}"' EXIT
+
+asset_path="${tmp_dir}/deskify-linux-x86_64"
+license_path="${tmp_dir}/LICENSE"
+
+curl -fL -o "${asset_path}" "${ASSET_URL}"
+curl -fL -o "${license_path}" "${LICENSE_URL}"
+
+ASSET_SHA256="$(sha256sum "${asset_path}" | awk '{print $1}')"
+LICENSE_SHA256="$(sha256sum "${license_path}" | awk '{print $1}')"
+
+cat > packaging/PKGBUILD <<EOF
+pkgname=deskify-bin
+pkgver=${PKGVER}
+pkgrel=1
+pkgdesc="Turn websites into Linux desktop apps (prebuilt binary package)"
+arch=('x86_64')
+url="https://github.com/spalencsar/deskify"
+license=('MIT')
+depends=('glibc')
+optdepends=('chromium: for --backend chromium')
+provides=('deskify')
+conflicts=('deskify')
+
+_tag="${TAG}"
+source=("deskify::https://github.com/spalencsar/deskify/releases/download/\${_tag}/deskify-linux-x86_64"
+        "LICENSE::https://raw.githubusercontent.com/spalencsar/deskify/\${_tag}/LICENSE")
+
+sha256sums=('${ASSET_SHA256}'
+            '${LICENSE_SHA256}')
+
+package() {
+  install -Dm755 "\${srcdir}/deskify" "\${pkgdir}/usr/bin/deskify"
+  install -Dm644 "\${srcdir}/LICENSE" "\${pkgdir}/usr/share/licenses/\${pkgname}/LICENSE"
+}
+EOF
+
+echo "Wrote packaging/PKGBUILD for ${TAG}"